5 Commits

Author	SHA1	Message	Date
Kyle Zhao	a6eca28ec6	CSP - extract all other inline JavaScripts (#6528) ... * wizard page inline js * print topic inline js * drop JS for preventing double submission this is the default behavior with Rails' UJS `disable_with` helper * omniauth complete redirect JS * account activate inline js	2018-10-25 09:52:01 -04:00
Sam	f4f5524190	FEATURE: user API now contains scopes so permission is granular ... previously we supported blanket read and write for user API, this change amends it so we can define more limited scopes. A scope only covers a few routes. You can not grant access to part of the site and leave a large amount of the information hidden to API consumer.	2016-10-14 16:05:42 +11:00
Sam	39e6cbc442	FIX: disable double submission which invalidates nonce	2016-09-04 16:05:25 +10:00
Sam	691f739f11	better error handling ... push notifications imply read access, no need for a special permission	2016-08-23 16:48:00 +10:00
Sam	b7cea24d76	FEATURE: more user API flow, support key creation	2016-08-16 17:06:52 +10:00